Merge "Refactor mini-keyctl and split a static library" am: 4fea237bf3 (aa200f7e) · Commits · e / os / android_system_core

libkeyutils/Android.bp

+0 −14

Original line number	Original line	Diff line number	Diff line
	@@ -16,17 +16,3 @@ cc_test {
	srcs: ["keyutils_test.cpp"],		srcs: ["keyutils_test.cpp"],
	test_suites: ["device-tests"],		test_suites: ["device-tests"],
	}		}

	cc_binary {
	name: "mini-keyctl",
	srcs: [
	"mini_keyctl.cpp",
	"mini_keyctl_utils.cpp"
	],
	shared_libs: [
	"libbase",
	"libkeyutils",
	"liblog",
	],
	cflags: ["-Werror", "-Wall", "-Wextra", "-fexceptions"],
	}

libkeyutils/mini_keyctl.cpp

deleted100644 → 0

+0 −90

Original line number	Original line	Diff line number	Diff line
	/*
	* Copyright (C) 2019 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	/*
	* A tool loads keys to keyring.
	*/

	#include "mini_keyctl_utils.h"

	#include <error.h>
	#include <stdio.h>
	#include <unistd.h>

	#include <android-base/parseint.h>

	static void Usage(int exit_code) {
	fprintf(stderr, "usage: mini-keyctl <action> [args,]\n");
	fprintf(stderr, " mini-keyctl add <type> <desc> <data> <keyring>\n");
	fprintf(stderr, " mini-keyctl padd <type> <desc> <keyring>\n");
	fprintf(stderr, " mini-keyctl unlink <key> <keyring>\n");
	fprintf(stderr, " mini-keyctl restrict_keyring <keyring>\n");
	fprintf(stderr, " mini-keyctl security <key>\n");
	_exit(exit_code);
	}

	static key_serial_t parseKeyOrDie(const char* str) {
	key_serial_t key;
	if (!android::base::ParseInt(str, &key)) {
	error(1 /* exit code /, 0 / errno */, "Unparsable key: '%s'\n", str);
	}
	return key;
	}

	int main(int argc, const char** argv) {
	if (argc < 2) Usage(1);
	const std::string action = argv[1];

	if (action == "add") {
	if (argc != 6) Usage(1);
	std::string type = argv[2];
	std::string desc = argv[3];
	std::string data = argv[4];
	std::string keyring = argv[5];
	return Add(type, desc, data, keyring);
	} else if (action == "padd") {
	if (argc != 5) Usage(1);
	std::string type = argv[2];
	std::string desc = argv[3];
	std::string keyring = argv[4];
	return Padd(type, desc, keyring);
	} else if (action == "restrict_keyring") {
	if (argc != 3) Usage(1);
	std::string keyring = argv[2];
	return RestrictKeyring(keyring);
	} else if (action == "unlink") {
	if (argc != 4) Usage(1);
	key_serial_t key = parseKeyOrDie(argv[2]);
	const std::string keyring = argv[3];
	return Unlink(key, keyring);
	} else if (action == "security") {
	if (argc != 3) Usage(1);
	const char* key_str = argv[2];
	key_serial_t key = parseKeyOrDie(key_str);
	std::string context = RetrieveSecurityContext(key);
	if (context.empty()) {
	perror(key_str);
	return 1;
	}
	fprintf(stderr, "%s\n", context.c_str());
	return 0;
	} else {
	fprintf(stderr, "Unrecognized action: %s\n", action.c_str());
	Usage(1);
	}

	return 0;
	}

libkeyutils/mini_keyctl/Android.bp

0 → 100644

+27 −0

Original line number	Original line	Diff line number	Diff line
			cc_library_static {
			name: "libmini_keyctl_static",
			srcs: [
			"mini_keyctl_utils.cpp"
			],
			shared_libs: [
			"libbase",
			"libkeyutils",
			],
			cflags: ["-Werror", "-Wall", "-Wextra"],
			export_include_dirs: ["."],
			}

			cc_binary {
			name: "mini-keyctl",
			srcs: [
			"mini_keyctl.cpp",
			],
			static_libs: [
			"libmini_keyctl_static",
			],
			shared_libs: [
			"libbase",
			"libkeyutils",
			],
			cflags: ["-Werror", "-Wall", "-Wextra"],
			}

libkeyutils/mini_keyctl_utils.cpp→libkeyutils/mini_keyctl/mini_keyctl.cpp

+68 −54

Original line number	Original line	Diff line number	Diff line
	@@ -14,79 +14,48 @@
	* limitations under the License.		* limitations under the License.
	*/		*/

	#include <mini_keyctl_utils.h>		/*
			* A tool loads keys to keyring.
			*/

	#include <dirent.h>		#include <dirent.h>
	#include <errno.h>		#include <errno.h>
	#include <error.h>		#include <error.h>
			#include <stdio.h>
	#include <sys/types.h>		#include <sys/types.h>
	#include <unistd.h>		#include <unistd.h>

	#include <fstream>
	#include <iostream>		#include <iostream>
	#include <iterator>		#include <iterator>
	#include <sstream>
	#include <string>		#include <string>
	#include <vector>

	#include <android-base/file.h>		#include <android-base/file.h>
	#include <android-base/parseint.h>		#include <android-base/parseint.h>
	#include <android-base/properties.h>
	#include <android-base/strings.h>
	#include <keyutils.h>		#include <keyutils.h>
			#include <mini_keyctl_utils.h>

	static constexpr int kMaxCertSize = 4096;		constexpr int kMaxCertSize = 4096;

	static std::vector<std::string> SplitBySpace(const std::string& s) {		static void Usage(int exit_code) {
	std::istringstream iss(s);		fprintf(stderr, "usage: mini-keyctl <action> [args,]\n");
	return std::vector<std::string>{std::istream_iterator<std::string>{iss},		fprintf(stderr, " mini-keyctl add <type> <desc> <data> <keyring>\n");
	std::istream_iterator<std::string>{}};		fprintf(stderr, " mini-keyctl padd <type> <desc> <keyring>\n");
			fprintf(stderr, " mini-keyctl unlink <key> <keyring>\n");
			fprintf(stderr, " mini-keyctl restrict_keyring <keyring>\n");
			fprintf(stderr, " mini-keyctl security <key>\n");
			_exit(exit_code);
	}		}

	// Find the keyring id. Because request_key(2) syscall is not available or the key is		static key_serial_t parseKeyOrDie(const char* str) {
	// kernel keyring, the id is looked up from /proc/keys. The keyring description may contain other		key_serial_t key;
	// information in the descritption section depending on the key type, only the first word in the		if (!android::base::ParseInt(str, &key)) {
	// keyring description is used for searching.		error(1 /* exit code /, 0 / errno */, "Unparsable key: '%s'\n", str);
	static key_serial_t GetKeyringIdOrDie(const std::string& keyring_desc) {
	// If the keyring id is already a hex number, directly convert it to keyring id
	key_serial_t keyring_id;
	if (android::base::ParseInt(keyring_desc.c_str(), &keyring_id)) {
	return keyring_id;
	}		}
			return key;
	// Only keys allowed by SELinux rules will be shown here.
	std::ifstream proc_keys_file("/proc/keys");
	if (!proc_keys_file.is_open()) {
	error(1, errno, "Failed to open /proc/keys");
	return -1;
	}

	std::string line;
	while (getline(proc_keys_file, line)) {
	std::vector<std::string> tokens = SplitBySpace(line);
	if (tokens.size() < 9) {
	continue;
	}
	std::string key_id = "0x" + tokens[0];
	std::string key_type = tokens[7];
	// The key description may contain space.
	std::string key_desc_prefix = tokens[8];
	// The prefix has a ":" at the end
	std::string key_desc_pattern = keyring_desc + ":";
	if (key_type != "keyring" \|\| key_desc_prefix != key_desc_pattern) {
	continue;
	}
	if (!android::base::ParseInt(key_id.c_str(), &keyring_id)) {
	error(1, 0, "Unexpected key format in /proc/keys: %s", key_id.c_str());
	return -1;
	}
	return keyring_id;
	}
	return -1;
	}		}

	int Unlink(key_serial_t key, const std::string& keyring) {		int Unlink(key_serial_t key, const std::string& keyring) {
	key_serial_t keyring_id = GetKeyringIdOrDie(keyring);		key_serial_t keyring_id = android::GetKeyringId(keyring);
	if (keyctl_unlink(key, keyring_id) < 0) {		if (keyctl_unlink(key, keyring_id) < 0) {
	error(1, errno, "Failed to unlink key %x from keyring %s", key, keyring.c_str());		error(1, errno, "Failed to unlink key %x from keyring %s", key, keyring.c_str());
	return 1;		return 1;
	@@ -101,7 +70,7 @@ int Add(const std::string& type, const std::string& desc, const std::string& dat
	return 1;		return 1;
	}		}

	key_serial_t keyring_id = GetKeyringIdOrDie(keyring);		key_serial_t keyring_id = android::GetKeyringId(keyring);
	key_serial_t key = add_key(type.c_str(), desc.c_str(), data.c_str(), data.size(), keyring_id);		key_serial_t key = add_key(type.c_str(), desc.c_str(), data.c_str(), data.size(), keyring_id);

	if (key < 0) {		if (key < 0) {
	@@ -114,7 +83,7 @@ int Add(const std::string& type, const std::string& desc, const std::string& dat
	}		}

	int Padd(const std::string& type, const std::string& desc, const std::string& keyring) {		int Padd(const std::string& type, const std::string& desc, const std::string& keyring) {
	key_serial_t keyring_id = GetKeyringIdOrDie(keyring);		key_serial_t keyring_id = android::GetKeyringId(keyring);

	// read from stdin to get the certificates		// read from stdin to get the certificates
	std::istreambuf_iterator<char> begin(std::cin), end;		std::istreambuf_iterator<char> begin(std::cin), end;
	@@ -137,7 +106,7 @@ int Padd(const std::string& type, const std::string& desc, const std::string& ke
	}		}

	int RestrictKeyring(const std::string& keyring) {		int RestrictKeyring(const std::string& keyring) {
	key_serial_t keyring_id = GetKeyringIdOrDie(keyring);		key_serial_t keyring_id = android::GetKeyringId(keyring);
	if (keyctl_restrict_keyring(keyring_id, nullptr, nullptr) < 0) {		if (keyctl_restrict_keyring(keyring_id, nullptr, nullptr) < 0) {
	error(1, errno, "Cannot restrict keyring '%s'", keyring.c_str());		error(1, errno, "Cannot restrict keyring '%s'", keyring.c_str());
	return 1;		return 1;
	@@ -162,3 +131,48 @@ std::string RetrieveSecurityContext(key_serial_t key) {
	context.resize(retval);		context.resize(retval);
	return context;		return context;
	}		}

			int main(int argc, const char** argv) {
			if (argc < 2) Usage(1);
			const std::string action = argv[1];

			if (action == "add") {
			if (argc != 6) Usage(1);
			std::string type = argv[2];
			std::string desc = argv[3];
			std::string data = argv[4];
			std::string keyring = argv[5];
			return Add(type, desc, data, keyring);
			} else if (action == "padd") {
			if (argc != 5) Usage(1);
			std::string type = argv[2];
			std::string desc = argv[3];
			std::string keyring = argv[4];
			return Padd(type, desc, keyring);
			} else if (action == "restrict_keyring") {
			if (argc != 3) Usage(1);
			std::string keyring = argv[2];
			return RestrictKeyring(keyring);
			} else if (action == "unlink") {
			if (argc != 4) Usage(1);
			key_serial_t key = parseKeyOrDie(argv[2]);
			const std::string keyring = argv[3];
			return Unlink(key, keyring);
			} else if (action == "security") {
			if (argc != 3) Usage(1);
			const char* key_str = argv[2];
			key_serial_t key = parseKeyOrDie(key_str);
			std::string context = RetrieveSecurityContext(key);
			if (context.empty()) {
			perror(key_str);
			return 1;
			}
			fprintf(stderr, "%s\n", context.c_str());
			return 0;
			} else {
			fprintf(stderr, "Unrecognized action: %s\n", action.c_str());
			Usage(1);
			}

			return 0;
			}

libkeyutils/mini_keyctl/mini_keyctl_utils.cpp

0 → 100644

+83 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* Copyright (C) 2019 The Android Open Source Project
			*
			* Licensed under the Apache License, Version 2.0 (the "License");
			* you may not use this file except in compliance with the License.
			* You may obtain a copy of the License at
			*
			* http://www.apache.org/licenses/LICENSE-2.0
			*
			* Unless required by applicable law or agreed to in writing, software
			* distributed under the License is distributed on an "AS IS" BASIS,
			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
			* See the License for the specific language governing permissions and
			* limitations under the License.
			*/

			#include <mini_keyctl_utils.h>

			#include <fstream>
			#include <iterator>
			#include <sstream>
			#include <string>
			#include <vector>

			#include <android-base/logging.h>
			#include <android-base/parseint.h>

			namespace android {

			namespace {

			std::vector<std::string> SplitBySpace(const std::string& s) {
			std::istringstream iss(s);
			return std::vector<std::string>{std::istream_iterator<std::string>{iss},
			std::istream_iterator<std::string>{}};
			}

			} // namespace

			// Find the keyring id. request_key(2) only finds keys in the process, session or thread keyring
			// hierarchy, but not internal keyring of a kernel subsystem (e.g. .fs-verity). To support all
			// cases, this function looks up a keyring's ID by parsing /proc/keys. The keyring description may
			// contain other information in the descritption section depending on the key type, only the first
			// word in the keyring description is used for searching.
			key_serial_t GetKeyringId(const std::string& keyring_desc) {
			// If the keyring id is already a hex number, directly convert it to keyring id
			key_serial_t keyring_id;
			if (android::base::ParseInt(keyring_desc.c_str(), &keyring_id)) {
			return keyring_id;
			}

			// Only keys allowed by SELinux rules will be shown here.
			std::ifstream proc_keys_file("/proc/keys");
			if (!proc_keys_file.is_open()) {
			PLOG(ERROR) << "Failed to open /proc/keys";
			return -1;
			}

			std::string line;
			while (getline(proc_keys_file, line)) {
			std::vector<std::string> tokens = SplitBySpace(line);
			if (tokens.size() < 9) {
			continue;
			}
			std::string key_id = "0x" + tokens[0];
			std::string key_type = tokens[7];
			// The key description may contain space.
			std::string key_desc_prefix = tokens[8];
			// The prefix has a ":" at the end
			std::string key_desc_pattern = keyring_desc + ":";
			if (key_type != "keyring" \|\| key_desc_prefix != key_desc_pattern) {
			continue;
			}
			if (!android::base::ParseInt(key_id.c_str(), &keyring_id)) {
			LOG(ERROR) << "Unexpected key format in /proc/keys: " << key_id;
			return -1;
			}
			return keyring_id;
			}
			return -1;
			}

			} // namespace android